Breach Disclosure: ScentBird

Breach Disclosure: Scentbird

In June 2020, the online fragrance service Scentbird suffered a data breach that exposed the personal information of over 5.8 million customers. Personal information including names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes and indicators of password strength were exposed.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Scentbird is a company that provides subscription service for designer fragrances. On July 27th, 2020, ShinyHunters posted a schema and sample data belonging to Scentbird on a popular hacking forum. This is one of many posts ShinyHunters has made in late July on RaidForums, where they provided access to breach data for approximately 2 EUR per breach.

Figure 1: Database Leak Post by ShinyHunters

Figure 2: Scentbird’s email:hashes offered for free